Three-factor account verification